EUVD-2026-76426
GHSA-q4pw-m5gm-wg9r
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Race condition requires winning a narrow kernel timing window, making AC:H more accurate than the input AC:L; all other metrics match.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
sched/core: Make core-sched flips wait for in-flight selections
Core scheduling's pick_next_task() operates on all sibling rqs under one acquisition of the shared core-wide lock. A ->pick_task() that releases the rq lock leaves every sibling __lock momentarily free, letting __sched_core_flip(false) complete mid-selection and rebind rq_lockp() under it. The selection resumes on the split locks, touching sibling state it no longer protects, and __schedule() finally releases a lock that was never taken while leaking the one that was.
Count in-flight core-wide selections in the leader's rq->core_pick_in_flight and make __sched_core_flip() wait for the count to drain. The count only changes under the shared lock, which the flip holds while sampling, so no other ordering is needed. The wait can repeat while selections overlap, but the flip backs off between samples and flips are rare cookie-lifetime events.
sched_core_cpu_deactivate() moves the count to the new leader - a stale copy left behind would bias it forever if that CPU later returns as its own leader.
AnalysisAI
Lock confusion in the Linux kernel's core scheduling subsystem (sched/core) exposes systems with SMT/hyperthreading and CONFIG_SCHED_CORE enabled to a local privilege escalation path from a low-privileged user. During pick_next_task() under the shared core-wide lock, a ->pick_task() implementation that momentarily drops the per-rq lock creates a window where __sched_core_flip(false) can complete and rebind rq_lockp(), causing the scheduler to operate on sibling run-queue state without holding the correct locks - __schedule() then releases a lock it never acquired while leaking the one it holds. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) Local access with at least standard unprivileged user credentials on the target system (AV:L/PR:L) - remote exploitation is not possible. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H scores 7.8, reflecting full C/I/A impact from a local, low-privileged attacker. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Linux 6.18.51, 7.2.4, or 7.3-rc1, which contain the fix introducing rq->core_pick_in_flight to serialize core-sched flips against in-flight selections. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running affected Linux kernel versions (6.18.x prior to 6.18.51, 7.2.x prior to 7.2.4, and 7.3 versions prior to 7.3-rc1) by reviewing kernel version inventory; prioritize production systems and those supporting multi-tenant or security-sensitive workloads. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today